sql-safe-mcp 1.5.1__tar.gz → 1.5.2__tar.gz

{sql_safe_mcp-1.5.1 → sql_safe_mcp-1.5.2}/CHANGELOG.md

@@ -7,6 +7,16 @@ categories `Added`, `Changed`, `Deprecated`, `Removed`, `Fixed`, and `Security`.
 
 ## [Unreleased]
 
+## [1.5.2] - 2026-10-05
+
+### Security
+
+- `execute_sql` now rejects a projection whose alias names anything other than a direct column,
+  a literal, or `COUNT(*)`, such as `SELECT (Email) AS e FROM Users`. Before, the expression was
+  classified as a literal, so a protected column wrapped in parentheses was returned in clear,
+  and on MySQL/MariaDB a projected comparison such as `(Email > 'm') AS x` acted as an oracle on
+  the protected value. The lineage stage also fails closed on any untraceable projection.
+
 ## [1.5.1] - 2026-09-23
 
 ### Fixed

{sql_safe_mcp-1.5.1 → sql_safe_mcp-1.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sql-safe-mcp
-Version: 1.5.1
+Version: 1.5.2
 Summary: Minimal, read-only, PII-safe MCP server for SQL databases.
 License: MIT License
         
@@ -133,7 +133,7 @@ or
 pip install sql-safe-mcp
 ```
 
-Pin a version when you want a fixed surface: `uvx sql-safe-mcp==1.5.1`.
+Pin a version when you want a fixed surface: `uvx sql-safe-mcp==1.5.2`.
 
 Requires Python 3.12–3.14, [uv](https://docs.astral.sh/uv/) (or `pip`), and
 [Microsoft ODBC Driver 18 for SQL Server](https://learn.microsoft.com/sql/connect/odbc/download-odbc-driver-for-sql-server)
@@ -265,9 +265,12 @@ only to stderr.
 ```
 
 can return a row such as `[42, "pii:v1:..."]`: the agent can follow the customer without reading
-the email address. A token is accepted only in `=` and `IN` predicates on the same protected column
-and server alias. Protection covers the columns you list, so list every column that holds personal
-data.
+the email address. A token is accepted only in `=` and `IN` predicates on the same server alias.
+If `FirstName` is protected, `SELECT FirstName FROM Users WHERE FirstName = 'Alice'` is rejected
+before it reaches the database. Filter protected columns only with authentic `pii:v1:...` tokens
+returned by `execute_sql` for the same alias; a matching prefix alone is not enough. Each token is
+authenticated and alias-bound, then validated and converted to a bound database value.
+Protection covers the columns you list, so list every column that holds personal data.
 
 ## Documentation
 

{sql_safe_mcp-1.5.1 → sql_safe_mcp-1.5.2}/README.md

@@ -95,7 +95,7 @@ or
 pip install sql-safe-mcp
 ```
 
-Pin a version when you want a fixed surface: `uvx sql-safe-mcp==1.5.1`.
+Pin a version when you want a fixed surface: `uvx sql-safe-mcp==1.5.2`.
 
 Requires Python 3.12–3.14, [uv](https://docs.astral.sh/uv/) (or `pip`), and
 [Microsoft ODBC Driver 18 for SQL Server](https://learn.microsoft.com/sql/connect/odbc/download-odbc-driver-for-sql-server)
@@ -227,9 +227,12 @@ only to stderr.
 ```
 
 can return a row such as `[42, "pii:v1:..."]`: the agent can follow the customer without reading
-the email address. A token is accepted only in `=` and `IN` predicates on the same protected column
-and server alias. Protection covers the columns you list, so list every column that holds personal
-data.
+the email address. A token is accepted only in `=` and `IN` predicates on the same server alias.
+If `FirstName` is protected, `SELECT FirstName FROM Users WHERE FirstName = 'Alice'` is rejected
+before it reaches the database. Filter protected columns only with authentic `pii:v1:...` tokens
+returned by `execute_sql` for the same alias; a matching prefix alone is not enough. Each token is
+authenticated and alias-bound, then validated and converted to a bound database value.
+Protection covers the columns you list, so list every column that holds personal data.
 
 ## Documentation
 

{sql_safe_mcp-1.5.1 → sql_safe_mcp-1.5.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sql-safe-mcp"
-version = "1.5.1"
+version = "1.5.2"
 description = "Minimal, read-only, PII-safe MCP server for SQL databases."
 readme = "README.md"
 requires-python = ">=3.12,<3.15"

{sql_safe_mcp-1.5.1 → sql_safe_mcp-1.5.2}/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/proprock/sql-safe-mcp",
     "source": "github"
   },
-  "version": "1.5.1",
+  "version": "1.5.2",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "sql-safe-mcp",
-      "version": "1.5.1",
+      "version": "1.5.2",
       "transport": {
         "type": "stdio"
       }

{sql_safe_mcp-1.5.1 → sql_safe_mcp-1.5.2}/src/sql_safe_mcp/__init__.py

@@ -1,3 +1,3 @@
 """Minimal, PII-safe MCP server for relational databases."""
 
-__version__ = "1.5.1"
+__version__ = "1.5.2"

{sql_safe_mcp-1.5.1 → sql_safe_mcp-1.5.2}/src/sql_safe_mcp/security/lineage.py

@@ -142,8 +142,11 @@ def _analyze_projections(
             outputs.append(OutputColumn(alias or canonical, "column", source, binding.name))
         elif isinstance(value, exp.Count):
             outputs.append(OutputColumn(alias or f"column_{index}", "count", None))
-        else:
+        elif isinstance(value, exp.Literal | exp.Null | exp.Neg):
             outputs.append(OutputColumn(alias or f"column_{index}", "literal", None))
+        else:
+            # Fail closed: a projection whose source cannot be traced is never a "literal".
+            raise reject(Reason.PROJECTION_UNSUPPORTED)
     return outputs
 
 

{sql_safe_mcp-1.5.1 → sql_safe_mcp-1.5.2}/src/sql_safe_mcp/security/parser.py

@@ -80,6 +80,10 @@ _ALLOWED_ARGS: dict[type[exp.Expr], frozenset[str]] = {
     **{comparison: frozenset({"this", "expression"}) for comparison in _COMPARISONS},
 }
 _PLACEHOLDER_ARGS = frozenset({"this"})
+# What an alias may name: a direct column, a literal, or COUNT(*). Anything else (a Paren, a
+# comparison, ...) would be invisible to lineage and could project a protected column in clear.
+# A Star under an alias is still rejected by the Star branch below with its own reason.
+_ALIASED = (exp.Column, exp.Star, exp.Literal, exp.Null, exp.Neg, exp.Count)
 _PROJECTIONS = (exp.Column, exp.Star, exp.Literal, exp.Null, exp.Neg, exp.Alias, exp.Count)
 
 
@@ -110,6 +114,9 @@ def _check_node(node: exp.Expr, allow_placeholders: bool) -> None:
     elif isinstance(node, exp.Column):
         if not isinstance(node.this, (exp.Identifier, exp.Star)):
             raise reject(Reason.COLUMN_REFERENCE_UNSUPPORTED)
+    elif isinstance(node, exp.Alias):
+        if not isinstance(node.this, _ALIASED):
+            raise reject(Reason.PROJECTION_UNSUPPORTED)
     elif isinstance(node, exp.Count):
         if not isinstance(node.this, exp.Star):
             raise reject(Reason.COUNT_STAR_ONLY)